CVE-2026-92414

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92414", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-16T09:33:25.002Z", "datePublished": "2026-10-07T15:46:44.549Z", "dateUpdated": "2026-10-07T20:29:20.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-07T15:46:44.549Z"}, "title": "Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens", "problemTypes": [{"descriptions": [{"description": "CWE-384: Session Fixation / Session Reuse across Users", "lang": "en", "cweId": "CWE-384", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Jackrabbit", "packageURL": "pkg:maven/org.apache.jackrabbit/jackrabbit-jcr-server", "versions": [{"status": "affected", "version": "2.23.0", "lessThanOrEqual": "2.23.5", "versionType": "semver"}, {"status": "affected", "version": "2.22.0", "lessThanOrEqual": "2.22.4", "versionType": "semver"}, {"status": "affected", "version": "2.20.0", "lessThanOrEqual": "2.20.17", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.jackrabbit:jackrabbit-jcr-server"}], "descriptions": [{"value": ": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.\n\n\n\nJackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with\n\nno credential check.\n\n\n\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.</p><p>Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with<br>\nno credential check.</p><p>This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.</p><p>\n</p><p></p><p>Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr", "tags": ["vendor-advisory"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Julian Reschke", "type": "analyst"}, {"lang": "en", "value": "Claude Security", "type": "tool"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/07/27"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-07T16:09:31.492Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T20:29:09.750450Z", "id": "CVE-2026-92414", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:29:20.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/07/27"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-07T16:09:31.492Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92414", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T20:29:09.750450Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:29:15.615Z"}}], "cna": {"title": "Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "The Apache Software Foundation"}, {"lang": "en", "type": "analyst", "value": "Julian Reschke"}, {"lang": "en", "type": "tool", "value": "Claude Security"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Jackrabbit", "versions": [{"status": "affected", "version": "2.23.0", "versionType": "semver", "lessThanOrEqual": "2.23.5"}, {"status": "affected", "version": "2.22.0", "versionType": "semver", "lessThanOrEqual": "2.22.4"}, {"status": "affected", "version": "2.20.0", "versionType": "semver", "lessThanOrEqual": "2.20.17"}], "packageURL": "pkg:maven/org.apache.jackrabbit/jackrabbit-jcr-server", "packageName": "org.apache.jackrabbit:jackrabbit-jcr-server", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": ": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.\n\n\n\nJackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with\n\nno credential check.\n\n\n\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.</p><p>Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with<br>\nno credential check.</p><p>This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.</p><p>\n</p><p></p><p>Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384: Session Fixation / Session Reuse across Users"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-07T15:46:44.549Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92414", "state": "PUBLISHED", "dateUpdated": "2026-10-07T20:29:20.098Z", "dateReserved": "2026-09-16T09:33:25.002Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-07T15:46:44.549Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.jackrabbit:jackrabbit-jcr-server", "packageURL": "pkg:maven/org.apache.jackrabbit/jackrabbit-jcr-server", "product": "Apache Jackrabbit", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.23.5", "status": "affected", "version": "2.23.0", "versionType": "semver"}, {"lessThanOrEqual": "2.22.4", "status": "affected", "version": "2.22.0", "versionType": "semver"}, {"lessThanOrEqual": "2.20.17", "status": "affected", "version": "2.20.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED33B3AA-CC33-415A-9B7D-3AEA9E13996D", "versionEndExcluding": "2.20.18", "versionStartIncluding": "2.20.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC45EF0E-2A77-4858-866D-1FE0E7C19241", "versionEndExcluding": "2.22.5", "versionStartIncluding": "2.22.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "matchCriteriaId": "9376FC7D-3C7E-4147-96FF-D63A7AAF2C60", "versionEndExcluding": "2.23.6", "versionStartIncluding": "2.23.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": ": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.\n\n\n\nJackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with\n\nno credential check.\n\n\n\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue."}], "id": "CVE-2026-92414", "lastModified": "2026-10-13T14:24:57.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92414", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T20:29:09.750450Z", "version": "2.0.3"}}]}, "published": "2026-10-07T16:19:12.900", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/10/07/27"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.jackrabbit/jackrabbit-webdav: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens", "id": "2547570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547570"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-613", "details": [": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.\nJackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with\nno credential check.\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.", "A flaw was found in jackrabbit-webdav. The WebDAV (Web Distributed Authoring and Versioning) server attaches a cached authenticated session when request header tokens\u2014such as lock, transaction, or subscription identifiers\u2014match, without verifying user credentials. An unauthenticated remote attacker can exploit this flaw to hijack existing user sessions, gaining unauthorized access to view or modify sensitive repository data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-92414", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Under investigation", "package_name": "jenkins-2-plugins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Under investigation", "package_name": "ocp-tools-4/jenkins-rhel8", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Under investigation", "package_name": "ocp-tools-4/jenkins-rhel9", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "maven-wagon", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "apache-commons-configuration", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "javapackages-tools:201801/maven-wagon", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "maven:3.9/maven-wagon", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "maven-wagon", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "jackrabbit-webdav", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-10-07T15:46:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92414\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92414\nhttps://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr"], "statement": "This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires an active authenticated session and predictable or known transaction or lock tokens to hijack access. In standard deployments, WebDAV endpoints are not exposed by default or operate within protected boundaries, limiting unauthorized remote access. Red Hat Enterprise Linux core packages do not include vulnerable standalone WebDAV server implementations from this library.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.23.0,2.23.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.22.0,2.22.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.20.0,2.20.17]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Jackrabbit", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "jackrabbit", "vendor": "apache"}], "created": "2026-10-07T18:45:12.706330+00:00", "updated": "2026-10-10T02:15:14.707364+00:00", "vendors": ["apache", "apache$PRODUCT$jackrabbit"]}